fix(rules): distinguish an absent rule directory from an unreadable one

`findRuleEngine`'s blanket `catch` read every `stat` failure as "not under
this engine". `EACCES` on a rule directory would therefore be reported as
absence, and `rule delete` would tell the user a rule that exists, and is
merely unreadable, was not found.

That is the same class of bug this function was added to fix, moved one
step: from "wrong engine assumed" to "real error misreported as absence".

`isMissingDirectory` exists for exactly this line and says so in its own doc
comment — `EACCES` above all is a real IO problem, and reading it as
"nothing here" is what makes an unreadable bucket indistinguishable from an
unwritten one. `dispatch.ts` already uses it. Now so does this.

Found by the review on #214.

Author: theCodeDrift

packages/cli/src/rules/engines.ts

@@ -2,6 +2,7 @@ import { readdir, stat } from "node:fs/promises";
 import { join } from "node:path";
 
 import { CLIError } from "../util/cli-error";
+import { isMissingDirectory } from "./errno";
 
 /**
  * Engines this CLI knows. The directory name under `.taskless/rules/` **is**
@@ -255,8 +256,14 @@ export async function findRuleEngine(
     try {
       const stats = await stat(ruleDirectory(cwd, engine, id));
       if (stats.isDirectory()) return engine;
-    } catch {
-      // Not under this engine; try the next.
+    } catch (error) {
+      // Only a genuinely absent directory means "not this engine". Swallowing
+      // every failure would read `EACCES` on a rule directory as absence, and
+      // the caller would then report a rule that is present but unreadable as
+      // not found — telling the user to treat an existing rule as gone. That
+      // is the same class of bug this function exists to fix, moved from
+      // "wrong engine assumed" to "real error misreported as absence".
+      if (!isMissingDirectory(error)) throw error;
     }
   }
   return undefined;

packages/cli/test/engine-dispatch.test.ts

@@ -1,8 +1,16 @@
 import { execFile } from "node:child_process";
-import { mkdir, mkdtemp, readdir, rm, stat, writeFile } from "node:fs/promises";
+import {
+  chmod,
+  mkdir,
+  mkdtemp,
+  readdir,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join, relative, resolve } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
@@ -259,6 +267,26 @@ describe("engine dispatch by directory", () => {
     }
   );
 
+  it("propagates a real IO error instead of reporting the rule absent", async () => {
+    // `EACCES` on a rule directory is not "no rule here". Reading it as
+    // absence would tell the user to treat a rule that exists, and is merely
+    // unreadable, as gone — the same class of bug this search exists to fix.
+    const directory = ruleDirectory(
+      temporaryDirectory,
+      "vale",
+      "logs-abc12345"
+    );
+    await mkdir(directory, { recursive: true });
+    await chmod(dirname(directory), 0o000);
+    try {
+      await expect(
+        deleteRuleFiles(temporaryDirectory, "logs-abc12345")
+      ).rejects.toMatchObject({ code: "EACCES" });
+    } finally {
+      await chmod(dirname(directory), 0o755);
+    }
+  });
+
   it("reports not-found for an id no engine holds", async () => {
     expect(await deleteRuleFiles(temporaryDirectory, "absent-abc12345")).toBe(
       false